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COMPLAINT 
UNITED STATES OF AMERICA 
Violations of 
- Vv. - : 31 0.S.C. § 5322, 
18 U.S.C. §§ 371 and 2 
NATALIE MAYFLOWER SOURS EDWARDS, 
a/k/a “Natalie Sours,” 
a/k/a “Natalie May Edwards,” 
a/k/a “May Edwards,” 


Defendant. 


SOUTHERN DISTRICT OF NEW YORK, SS.: 


EMILY P. ECKSTUT, being duly sworn, deposes and says that 
she is a Special Agent with the Federal Bureau of Investigation 
(“FBI”), and charges as follows: 


COUNT ONE 
(Unauthorized Disclosure of Suspicious Activity Reports) 


1. From at least in or about October 2017, up to and 
including in or about October 2018, NATALIE MAYFLOWER SOURS 
EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie May Edwards,” 
a/k/a “May Edwards,” the defendant, an employee of a federal 
government authority, willfully violated subchapter II of Title 
31 and a regulation and order prescribed thereunder, namely 
Section 1023.320(e) (2) of Title 31 of the Code of Federal 
Regulations, by disclosing Suspicious Activity Reports (“SARs”), 
and information.that would reveal the existence of a SAR, which 
disclosure was not necessary to fulfill EDWARDS’s official 
duties, to wit, EDWARDS knowingly disclosed and described SARs, 
which she obtained by virtue of her position as a Senior Advisor 
at the United States Department of Treasury, Financial Crimes 
Enforcement Network (“FinCEN”), including by electronically - 
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sending images of such SARs to a member of the news media 
(“Reporter-1”) via an encrypted application. 


(Title 31, United States Code, Section 5322(a); Title 18, United 
States Code, Section 2.) 


COUNT TWO 
(Conspiracy to Make Unauthorized Disclosures 
of Suspicious Activity Reports) 


2% From at least in or about October 2017, up to and 
including in or about October 2018, NATALIE MAYFLOWER SOURS 
EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie May Edwards,” 
a/k/a “May Edwards,” the defendant, and others known and 
unknown, willfully and knowingly did combine, conspire, 
confederate, and agree together and with another to commit an 
offense against the United States, to wit, to make unauthorized 
disclosures of SARs and the existence of SARs, in violation of 
Title 31, United States Code, Section 5322 and Title 31, Code of 
Federal Regulations, Section 1020.320(e) (2). 


ce It was a part and an object of the conspiracy that 
NATALIE MAYFLOWER SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a 
“Natalie May Edwards,” a/k/a “May Edwards,” the defendant, and 
others known and unknown, would and did knowingly disclose and 
describe SARs, which EDWARDS obtained by virtue of her position 
as a Senior Advisor at FinCEN. 


OVERT ACTS 


4. In furtherance of the conspiracy and to effect the 
illegal object thereof, the following overt acts, among others, 
were committed and caused to be committed: 


a. On or about August 2, 2018, NATALIE MAYFLOWER 
SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie May 
Edwards,” a/k/a “May Edwards,” the defendant, exchanged 
approximately 541 messages with Reporter-1 via a certain 
encrypted application (the “Encrypted Application”). 


b. On various occasions between in or about October 
2017 and in or about October 2018, EDWARDS transmitted files 
containing or describing SARs to Reporter-1 via the Encrypted 
Application. : 
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c. Between on or about August 24, 2018 and October 
2, 2018, a co-conspirator not named as a defendant herein (“CC- 
1”) exchanged approximately 301 messages with Reporter-1 via the 
Encrypted Application. 


d. On or about October 16, 2018, in an interview in 
the Eastern District of Virginia with federal law enforcement 
agents (the “Interviewing Agents”), EDWARDS initially concealed 
her relationship with Reporter-1 and denied having any contacts 
with the news media. 


(Title 18, United States Code, Section 371.) 


The bases for my knowledge and the foregoing charges 
are, in part, as follows: 


Dx I am a Special Agent with the FBI and have been so 
employed for approximately four years. Within the FBI, I am 
assigned to a squad focused on public corruption crimes 
committed by government officials and others. 


6. I have been personally involved in the investigation 
of this matter. This Affidavit is based upon my personal | 
participation in the investigation, my review of law enforcement 
records, and my conversations with other law enforcement agents. 
Because this Affidavit is being submitted for the limited 
purpose of demonstrating probable cause, it does not include all 
the facts I have learned during the course of my investigation. 
Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported 
in substance and in part, except where otherwise indicated. 


FinCEN, Suspicious Activity Reports, and Relevant Statutes 


Ts The mission of FinCEN is to “safeguard the financial 
system from illicit use and combat money laundering and promote 
national security through the collection, analysis, and 
dissemination of financial intelligence and strategic use of 
financial authorities.”! Among other things, FinCEN manages the 
collection and maintenance of suspicious activity reports (more 
commonly known as “SARs”). Under the Bank Secrecy Act of 1970 
(“BSA”), United States financial institutions and other parties 
are required by law to generate SARs in order to report 
potentially suspicious financial transactions, and to deliver 
the SARs to FinCEN. FinCEN in turn maintains a centralized 


: https://www. fincen.gov/about/mission. 
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database of the SAR data, which it makes available to law 
enforcement pursuant to regulations and procedures that protect 
the confidentiality of the information. 


8. Under the BSA and its implementing regulations, 
disclosure of a SAR or its contents is unlawful. Specifically, 
31 C.F.R. § 1020.320(e) provides that “[{a] SAR, and any 
information that would reveal the existence of a SAR, are 
confidential and shall not be disclosed except as authorized [by 
law].” Subsection 1020.320(e) (2) prohibits employees or agents 
of government authorities from “disclos[ing] a SAR, or any 
information that would reveal the existence of a SAR, except as 
necessary to fulfill official duties consistent with Title II of 
the Bank Secrecy Act.” Title 31, United States Code, Section 
5322(a) imposes criminal penalties for willful violations of the 
BSA and its implementing regulations, including the disclosure 
of a SAR. . 


Unauthorized SAR Disclosures 


oe Together, the FBI and the United States Department of 
Treasury—Office of Inspector General (“Treasury-OIG”) have been 
investigating a series of unauthorized disclosures of SARs and 
SAR information occurring between in or about October 2017 and 
continuing into at least mid-October 2018. 


10. From my participation in the investigation and my 
conversations with other law enforcement agents involved in the 
investigation, I have learned the following, in substance and in 
part: 


a. Treasury-OIG agents have identified a pattern of 
unauthorized disclosures of SAR information appearing in the media 
starting in or about October 2017 and continuing until in or about 
the present (collectively, the “SARs Disclosures”). Each of the 
SARs Disclosures related to matters relevant to investigations 
being conducted by the Office of the Special Counsel, the United 
States Attorney’s Office for the Southern District of New York, 
and/or the National Security Division of the United States 
Department of Justice, such as suspicious transactions relating to 
Paul Manafort, Richard W. Gates, Russian diplomatic accounts, and 
other matters. 


b. The SARs Disclosures included the following: 


i. Between October 2017 and March 2018, a news 
organization (the “News Organization”), headquartered in New York, 
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New York, published approximately twelve news articles containing 
detailed information that appeared to track the contents of SARs 
protected by the BSA (collectively, the “SARs Disclosure 
Articles”). 


ss The articles were published on or about 
October 29, 2017 (the “October 2017 Article”); November 14, 2017 
(the “November 2017 Article”); January 17, 2018 (the “January 2018 
Article”); February 19, 2018 (the “February 2018 Article”); and 
March 16, 2018 (the “March 2018 Article”); July 31, 2018 (the “July 
2018 Article”); August 10, 2018 (the “First August 2018 Article”); 
August 29, 2018 (the “Second August 2018 Article”); September 12, 
2018 (the “First September 2018 Article”); September 21, 2018 (the 
“September 21, 2018 Article”); and October 15, 2018 (the “October 
2018 Article”). Reporter-1 was listed as an author (though not 
always the only author) of all of the SARs Disclosure Articles. 


bi ee The October 2017 Article claimed that the News 
Organization “has learned specific details about 13 [] wire 
transfers” related to Paul Manafort “all of which took place 
between 2012 and 2013,” and described that “[t]he transfers were 
first flagged by US financial institutions, which are required by 
law to tell an office within the Treasury Department about any 
transactions they deem suspicious” in the form of “suspicious 
activity reports.” 


iv. The November 2017 Article was entitled “Secret 
Finding: 60 Russian Payments To Finance Election Campaign Of 2016,” 
and also referenced “suspicious activity reports” and their 
findings. 


Ve Similarly, the January 2018 Article referred 
to detailed financial “[r]ecords reviewed exclusively by [the News 
Organization]” related to financial transactions involving the 
Russian Embassy, stating that “[t]he Treasury Department turned 
over the suspicious activity reports to the FBI” after “f{e]lach of 
these transactions sparked a ‘suspicious activity report’ sent to 
the US Treasury’s financial crimes unit [that is, FinCEN] by 
Citibank, which handles accounts of the Russian Embassy,” and 
citing to a “US official with knowledge of the inquiry.” 


vi. The February 2018 Article and March 2018 
Article likewise specifically referenced “suspicious activity 
reports” associated with Paul Manafort in detail, and the March 
2018 article specifically discussed actions taken by FinCEN with 


respect to the reports. 
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vii. The July 2018 Article was entitled “Russian 
‘Agent’ And a GOP Operator Left a Trail of Cash, Documents Reveal.” 
The July 2018 Article described in extensive detail a series of 
financial transactions derived from bank records allegedly 
involving a political consultant and Mariia Butina, who was 
indicted on or about July 17, 2018 in the United States District 
Court for the District of Columbia for acting as an unregistered 
foreign agent and conspiracy to commit the same. The July 2018 
Article described “suspicious transactions cited by the bank and 
federal investigators,” “none of which have been made public.” 
Based upon my training, experience, and my conversations with other 
law enforcement agents involved in the investigation, I believe 
that these references indicate that the data in the July 2018 
Article was obtained from SARs. 


viii. The First August 2018 Article was entitled 
“GOP Operative Made ‘Suspicious’ Cash Withdrawals During Pursuit 
of Clinton Emails.” The First August 2018 Article discussed 
specific financial transactions made by an individual who 
purportedly launched an independent effort in 2016 to obtain emails 
belonging to Hillary Clinton from Russian hackers. For example, 
the First August 2018 Article claimed that “[a]fter scouring nine 
accounts that [the individual] controlled, Northern Trust turned 
over documents showing 88 suspicious cash withdrawals totaling 
about $140,000 between January 2016 and April 2017, including a 
$3,000 withdrawal six days after the election” and noted that “the 
bank sent a report to Treasury’s financial crimes unit, which 
shared its findings with the FBI, special counsel Robert Mueller, 
and Senate Intelligence Committee investigators.” Based upon my 
training, experience, and my conversations with other law 
enforcement agents involved in the investigation, I believe that 
the data in the First August 2018 Article was obtained from SARs. 


ax The Second August 2018 Article was entitled 
“Here’s Why the FBI and Mueller Are Investigating ‘Suspicious’ 
Transactions by Russian Diplomats.” The article, which discussed 
suspicious transactions by, among others, a previous Russian 
ambassador to the United States, noted that “Citibank sent 
information that it compiled about [the ambassador’s] and the 
[Russian] embassy’s accounts to the US Treasury Department's 
financial crimes unit [that is, FinCEN] and the FBI in early 2017,” 
and discussed the details of two specific financial transactions 
—- one approximately 10 days after the U.S. presidential election, 
and another five days after the U.S. presidential inauguration. 
The article cited “three federal law enforcement sources with 
direct knowledge of the matter” as its sources. Based upon my 
training, experience, and my conversations with other law 
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enforcement agents involved in the investigation, I believe that 
these references indicate that the data in the Second August 2018 
Article was obtained from SARs. 


x, The First September 2018 Article was entitled 
“A Series of Suspicious Money Transfers Followed the Trump Tower. 
Meeting.” The article discussed “secret documents reviewed by 
{the News Organization],” and specifically referenced “two bursts 
of transactions that bank examiners deemed suspicious” involving 
a wealthy Russian family—one of whom had allegedly arranged a 
meeting at Trump Tower between a é Russian national and 
representatives of the Trump campaign during the 2016 presidential 
campaign (the “Trump Tower Meeting”)—and their business associates 
in the aftermath of the Trump Tower Meeting. The article revealed 
the dates, amounts, and parties involved in the transactions in 
extensive detail, specifically stating that the transactions were 
identified after “bankers filed ‘suspicious activity reports’ to 
the Treasury Department’s Financial Crimes Enforcement Network 
[that is, FinCEN], which in turn shared them with the FBI, the 
IRS, congressional committees investigating Russian interference, 
and members of special counsel Robert Mueller’s team.” The article 
cited “four federal law enforcement officials” as its sources. 
Based upon my training, experience, and my conversations with other 
law enforcement agents involved in the investigation, I believe 
that these references indicate that the data in the First September 
. 2018 Article was obtained from SARs. 


Ki. The September 21, 2018 Article was entitled 
“The Planners Of The Trump Tower Meeting Moved Millions, And 
Mueller Is Now Investigating.” Referring to “[{djocuments reviewed 
by [the News Organization],” the September 21, 2018 Article 
described “suspicious transactions” of approximately $3.3 million 
relating to “a billionaire real estate developer close to both 
Vladimir Putin and President Donald Trump,” among others, 
occurring in or around June 2016, close in time to the Trump Tower 
Meeting. The September 21, 2018 Article specifically noted “[t]he 
details unearthed by bankers were compiled in “suspicious activity 
reports” sent to the Treasury Department’s Financial Crimes 
Enforcement Network [that is, FinCEN], which shared them with other 
law enforcement agencies investigating Russian interference.” 
Based upon my training, experience, and my conversations with other 
law enforcement agents involved in the investigation, I believe 
that these references indicate that the data in the September Z1, 
2018 Article was obtained from SARs. 


24... The October 2018 Article was entitled “Here’s 
How a Major Western Bank Enabled A Suspected Russian Money 
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Launderer.” The October 2018 Article related to Prevezon Alexander 
(“Prevezon”), an entity charged in a previous civil forfeiture 
case in the Southern District of New York relating to an alleged 
Russian money laundering scheme in which an investment company 
(the “Investment Company”) was among the victims, among other 
things. The October 2018 Article discussed a loan made by a 
particular banking institution to a Prevezon subsidiary, and noted 
that “[{t]he records of this transaction, which have never been 
publicly reported, were unearthed by the US Treasury Department’s 
financial crimes unit [that is, FinCEN] during investigations by 
Congress and special counsel Robert Mueller, both of whom are 
digging into Russia’s interference in the 2016 election.” Based 
upon my training, experience, and my conversations with other law 
enforcement agents involved in the investigation, I believe that 
these references indicate that the data in the October 2018 Article 
was obtained from SARs. 


11. Based upon my conversations with other law enforcement 
agents who have reviewed the SARs Disclosure Articles described 
above, I have learned that several of the SARs Disclosure 
Articles described various transactions occurring in or through 
New York, New York, and refer to reports made by financial 
institutions with offices in New York, New York. 


Overview of EDWARDs’ Access to and Unlawful Disclosure of SARs 


12s As described in more detail below, there is probable 
cause to believe that NATALIE MAYFLOWER SOURS EDWARDS, a/k/a 
“Natalie Sours,” a/k/a “Natalie May Edwards,” a/k/a “May > 
‘Rdwards,” the defendant, without authorization, provided some or 
all of the SARs Disclosures to Reporter-1 for publication, and 
was aware that a purpose of at least certain of such SARS 
Disclosures was for publication by the News Organization. 
Specifically, for the reasons set forth below, I believe that: 


a. EDWARDS began communicating with Reporter-1 in or 
about July 2017. 


b. EDWARDS had access to all of the SARs implicated 
by the SARs Disclosures. Between in or about October 2017 - the 
-month when the SARs Disclosures began - and January 2018, 
EDWARDS saved thousands of FinCEN. files, including all of the 
SARs implicated by the SARs Disclosures, to a flash drive 
provided to her by FinCkEN. 


c. Throughout the course of 2018, EDWARDS engaged in 
hundreds of electronic communications with Reporter-1, many via 
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an encrypted application. A review to date, pursuant to a 
judicially-authorized search warrant executed today, of 
EDWARDS’s personal cellphone has revealed that that cellphone 
contains the substance of many of these communications, 
including, as described in greater detail below, communications 
in which EDWARDS transmitted or described SARs or other BSA- 
protected information to Reporter-l. 


d. When questioned by law enforcement officials 
earlier today, EDWARDS confessed that she had provided SARs to 
Reporter-1 via an encrypted application, though falsely denied 
knowing that Reporter-1 intended to or did publish that 
information through the News Organization. At the time she was 
questioned, EDWARDS was also in possession of a flash drive that 
appeared to be the same drive on which she saved the SARs 
related to the SARs Disclosures, among other files. 


EDWARDS’s Access to SARS 


13. Based on my conversations with other law enforcement 
agents who have reviewed emails obtained from a government email 
address assigned to NATALIE MAYFLOWER SOURS EDWARDS, a/k/a 
“Natalie Sours,” a/k/a “Natalie May Edwards,” a/k/a “May 
Edwards,” the defendant (the “EDWARDS Work Account”) and 
electronic files maintained by FinCEN, I have learned that 
EDWARDS has access to certain electronic folders maintained on 
FinCEN’s network that contain many, if not all, of the SARs at 
issue in the SARs Disclosures. 


14. Based upon my conversations with other law enforcement 
agents who have consulted with Treasury analysts who conducted a 
forensic review of government computer usage by NATALIE 
MAYFLOWER SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie 
May Edwards,” a/k/a “May Edwards,” the defendant, and certain 
records from Treasury’s networks, and Treasury staff regarding 
the electronic equipment issued by FinCEN to EDWARDS, I have 
learned the following, among other things: 


a. Prior to in or about January 2017, at least one 
government-issued external flash drive (the “Flash Drive”) was 
provided to EDWARDS for work purposes. 


b. Through forensic analysis to date, FinCEN has been 
able to identify records reflecting that more than 24,000 files 
were saved to the Flash Drive between approximately January 2017 
and approximately January 2018 (the “Flash Drive Files”). The 
majority of the files were saved to a folder on the Flash Drive 
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entitled “Debacle -— Operation-CF,” and subfolders bearing names 
such as “Debacle\Emails\Asshat.” EDWARDS is not known to be 
involved in any official FinCEN project or task bearing these file 
titles or code names. 


Cc. Based upon my conversations with other law 
enforcement agents who have spoken with FinCEN analysts, who have 
in turn, reviewed the names of the Flash Drive Files, and conducted 
a comparison of those file names/sizes to records contained on 
FinCEN’s network, the Flash Drive Files appear to contain thousands 
of SARs, along with other highly sensitive material relating to 
Russia, Iran, and the terrorist group known as the Islamic State 
of Iraq and the Levant (more commonly known as “ISIL” or “ISIS”), 
among other things. Multiple files also bear labels referencing 
Paul Manafort and Reporter-1’s name. 


d. Based upon the same, it appears that the Flash Drive 
Files include all of the SARs implicated by the SAR Disclosures 
published by the News Organization. Available data indicates that 
these SARs were first saved to the Flash Drive by at least on or 
about October 18, 2017 - approximately 11 days prior to the 
publication of the first SAR Disclosure, that is, the October 2017 
Article. Additional files relating to SARs were saved to the Flash 
Drive again on or about January 8, 2018. 


15. Through my conversations with other law enforcement 
agents who have spoken with FinCEN staff, I have been informed 
that there is no known legitimate business purpose for NATALIE 
MAYFLOWER SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie 
May Edwards,” a/k/a “May Edwards,” the defendant, to save the 
large quantity of Flash Drive Files, and particularly, the SARs 
related to the SARs Disclosures, to the Flash Drive. 


EDWARDS’s Communications with Reporter-1 


16. Based on my conversations with other law enforcement 
agents who have reviewed emails obtained pursuant to a 
judicially-authorized search warrant on a web-based personal 
email account believed to be used by NATALIE MAYFLOWER SOURS 
EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie May Edwards,” 
a/k/a “May Edwards,” the defendant (the “EDWARDS Personal 
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Account”),2 I have learned that Reporter-1 first contacted 
EDWARDS in or about July 2017 seeking information regarding an 
issue that did not implicate the SARs Disclosures. 


17. Based upon my conversations with other law enforcement .. 
agents who have reviewed phone records for a personal cellphone 
subscribed to by NATALIE MAYFLOWER SOURS EDWARDS, a/k/a “Natalie 
Sours,” a/k/a “Natalie May Edwards,” a/k/a “May Edwards,” the 
defendant (respectively, the “EDWARDS Phone Records” and the 
“EDWARDS Cellphone”), I have learned, in part, that: 


a. On or about February 14, 2018, approximately five 
days prior to the publication of the February 2018 Article, the 
EDWARDS Phone sent approximately four text messages to a cellphone 
associated with Reporter-1 (the “Reporter-1 Cellphone”). 


b. On or about July 27, 2018, days before the 
publication of the July 2018 Article, the EDWARDS Cellphone placed 
a phone call to the Reporter-1 Cellphone, beginning at 
approximately 3:43 p.m. and lasting approximately 15 minutes. 


c. On or about August 2, 2018, approximately two days 
after the publication of the July 2018 Article and approximately 
one week before the publication of the First August 2018 Article, 
the EDWARDS Cellphone placed a phone call to the Reporter-1 
Cellphone, beginning at approximately 9:08 p.m. and lasting more 
than 23 minutes. 


d. On or about August 3, 2018--approximately seven 
days before the publication of the First August 2018 Article—- 
several short calls, each lasting less than one minute, were 
exchanged between the EDWARDS Cellphone and the Reporter-1 
Cellphone, beginning at approximately 9:54 a.m. At approximately 
10:11 a.m., the EDWARDS Cellphone received a phone call lasting 
more than five minutes from the Reporter-1 Cellphone. 


e. On or about August 17, 2018, approximately one week 
after the publication of the First August 2018 Article and 
approximately 12 days before the publication of the Second August 
2018 Article (discussed further below), the EDWARDS Cellphone 





2 Among other things, subscriber information relating to the 
EDWARDS Personal Account identifies the subscriber as “May E,” 
and search warrant results have revealed that the user of the 
EDWARDS Personal Account routinely introduces herself as “Dr. 
May Edwards,” and describes herself as a FinCEN employee with a 
professional background matching that of EDWARDS. 
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placed a phone call to the Reporter-1 Cellphone, which began at 
approximately 11:43 p.m. and lasted nearly 40 minutes. 


f. On or about September 7, 2018, approximately five 
days prior to the publication of the First September 2018 Article, 
the EDWARDS Cellphone placed a phone call to the Reporter-1 
Cellphone, which began at approximately 1:25 p.m. and lasted for 
nearly three minutes. 


18. Based-upon my training, experience, my conversations 
with other law enforcement agents with training and experience 
in cyber technology, and my conversations with law enforcement 
agents who have reviewed records received in response toa 
judicially-authorized pen register and trap and trace order for 
the EDWARDS Cellphone (the “EDWARDS Pen”), I have learned, among 
other things, that: 


a. The EDWARDS Cellphone utilized a mobile messaging 
service that utilizes end-to-end encryption (the “Encrypted 
Application”), that is, a method of secure communication that 
prevents third-parties from accessing data, including the 
companies that host the end-to-end encrypted services, and law 
enforcement. 


b. On or about August 1, 2018, within approximately 
six hours of the EDWARDS Pen becoming operative—-and the day after 
the July 2018 Article was published--the EDWARDS Cellphone 
exchanged approximately 70 messages via the Encrypted Application 
with the Reporter-1 Cellphone during an approximately 20-minute 
time span between 12:33 a.m. and 12:54 a.m. 


c. Between on or about July 31, 2018 and August 2, 
2018, the EDWARDS Cellphone and the personal cellphone of cCC-1 
exchanged dozens of messages via the Encrypted Application. 


d. On or about August 2, 2018, approximately one week 
prior to the publication of the First August 2018 Article, the 
EDWARDS Cellphone exchanged approximately 541 messages with the 
Reporter-1 Cellphone via the Encrypted Application. 


e.On or about August 10, 2018, the day of the 

publication of the First August 2018 Article, the EDWARDS Cellphone 
and the Reporter-1 Cellphone exchanged approximately 11 messages 
via the Encrypted Application. 
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f. On or about August 15, 2018, the EDWARDS Cellphone 
exchanged approximately 14 messages with the Reporter-1 Cellphone 
via the Encrypted Application. 


CC-1’s Communications with Reporter-1 


19. Based on my participation in the investigation and my 
conversations with other law enforcement agents who have 
reviewed documents obtained in the investigation to date, I have 
learned that CC-1 is an Associate Director of FinCEN to whom 
NATALIE MAYFLOWER SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a 
“Natalie May Edwards,” a/k/a “May Edwards,” the defendant, 
reports. 


20. Based on my conversations with other law enforcement 
agents who have reviewed phone records for a cellphone 
documented in FinCEN records as the personal cellphone number 
for CC-1 (the “CC-1 Cellphone”), I have learned that in or about 
October 2017 — i.e., the month of the October 2017 Article 
containing SARs Disclosures - the CC-1 Cellphone exchanged 
approximately 325 text messages with the Reporter-1 Cellphone. 


21. Based upon my conversations with other law enforcement 
agents who have reviewed records to date in response to a 
judicially-authorized pen register and trap and trace order for 
the CC-1 Cellphone, I have learned, in part, that: 


a. On or about August 15, 2018, the CC-1 Cellphone 
exchanged approximately 10 messages with the Reporter-1 Cellphone 
via the Encrypted Application. 


b. Between -on or about August 24, 2018 and October rae 
2018, the CC-1 Cellphone exchanged approximately 301 messages with 
the Reporter-1 Cellphone via the Encrypted Application. 


The Interview and Search of EDWARDS 


22. Based upon my conversations with the Interviewing 
Agents, I have learned that today, after the Interviewing Agents 
identified themselves, and stated, in sum, that they wished to 
speak with NATALIE MAYFLOWER SOURS EDWARDS, a/k/a “Natalie 
Sours,” a/k/a “Natalie May Edwards,” a/k/a “May Edwards,” the 
defendant, the following conversation took place, in substance 
and in part: 
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a. Initially, EDWARDS denied having any contact 
with any member the news media, but indicated that she was aware 
that CC-1 and another FinCEN employee (“Employee-1”) were in 
contact with the news media. 


b. Upon direct questioning regarding Reporter- 
1, EDWARDS changed her account, and admitted that, on numerous 
occasions, she accessed SARs on her computer, photographed them, 
and sent those photographs to Reporter-1 using the Encrypted 
Application. 


Cx EDWARDS further admitted to meeting 
Reporter-1 in person on at least two occasions. 


d. EDWARDS claimed not to have read the SARs 
Disclosure Articles published by Reporter-1, and claimed no 
knowledge that the SAR information she disclosed to Reporter-1 
was published. As set forth below, information relating to 
EDWARDS’s Internet usage demonstrates that this statement is 
false.3 


23. Based upon my conversations with the Interviewing 
Agents, I have further learned that, in connection with the 
above-described interview and pursuant to a judicially- 
authorized search warrant, law enforcement agents conducted a 
search of NATALIE MAYFLOWER SOURS EDWARDS, a/k/a “Natalie 
Sours,” a/k/a “Natalie May Edwards,” a/k/a “May Edwards,” the 
defendant, and recovered an electronic storage media item 
believed to be the Flash Drive as well as at least one 
cellphone, believed to the EDWARDS Cellphone. 


24. Based upon my conversations with other law enforcement 
agents who have reviewed to date results from the judicially- 
authorized search of the cellphone seized today from NATALIE 
MAYFLOWER SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie 
May Edwards,” the defendant, I have learned the following, among 
other things: 





3 During the interview described herein, EDWARDS told the 
Interviewing Agents, in sum and substance, that she is a 
“whistleblower” who provided the SARs to Reporter-1 for “record 
keeping.” Based on my participation in this investigation and 
my conversations with other law enforcement agents, I am aware 
that, prior to the SARs Disclosures, EDWARDS had previously 
filed a whistleblower complaint unrelated to the SARs 
Disclosures, and that EDWARDS had also reached out to 
congressional staffers regarding, among other things, her 
unrelated whistleblower complaint. 
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a. On various occasions between in or about October 
2017, up to and including in or about October 2018, EDWARDS 
transmitted the following items and information, among others, 
via the Encrypted Application, to Reporter-1: 


1s SARs, including but not limited to SARs 
related to the SARs Disclosures published by the News 
Organization; 


ii. Files and spreadsheets reflecting SAR data, 
including data relating to the existence of SARs; 


iii. The results of searches by EDWARDS for 
whether SARs had been filed with respect to certain people or 
entities, in which Reporter-1 appeared interested; 


iv. FinCEN internal emails appearing to relate 
to SARs or other information protected by the BSA; and 


vs FinCEN non-public memoranda, including 
Investigative Memos and Intelligence Assessments published by 
the FinCEN Intelligence Division, which contained confidential 
personal, business, and/or security threat assessments, 
including those marked “Law Enforcement Sensitive” and that 
contained BSA-protected information. 


b. For example, in one exchange, EDWARDS appeared to 
send Reporter-1 a series of approximately five spreadsheet 
files, all containing SAR identifying numbers in the file 
titles. EDWARDS then appeared to send a 465-page file labeled 
“Paul Manafort [] request from Senate Select Committee on 
Intelligence.pdf” (the “Manafort File”). As sent by EDWARDS, 
the Manafort File appeared to display an image of an actual SAR 
on the face of the message to Reporter-l. 


c. As noted above, the October 2018 Article 
regarded, among other things, Prevezon and -the Investment 
Company. As recently as September 2018, EDWARDS and Reporter-1 
engaged in the following conversation, via the Encrypted 
Application, in relevant part: 
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EDWARDS: I am not getting any hits on [the CEO 
of the Investment Company] 
do you have any idea what the 
association is 
if I had more information i could 
search in different areas 


Reporter-1: If not on his name it would be [the 
Investment Company]. That’s the only 
other one 
[The CEO] is associated with Prevezon 
Well not associated : 


His company is [the Investment Company] 


d. Based upon my training and experience, my 
participation in the investigation, and my conversations with 
other law enforcement agents familiar with the investigation, I 
believe that in the above conversation, EDWARDS was explaining 
that she had performed searches of FinCEN records relating to 
Prevezon, at Reporter-1’s request, in order to supply SAR 
information for the October 2018 Article. 


e. In addition, in multiple communications, EDWARDS 
and Reporter-1 referenced CC-1, and Reporter-1 expressed that 
Reporter-1 was also in contact with CC-1. 


25. Subsequent to the interview and search described 
above, NATALIE MAYFLOWER SOURS EDWARDS, a/k/a “Natalie Sours,” 
a/k/a “Natalie May Edwards,” a/k/a “May Edwards,” the defendant, 
was placed under arrest. 


EDWARDS’s Personal Email Account 
26. Based on my conversations with other law enforcement 
agents who have reviewed to date the contents and other 


information of the EDWARDS Personal Account, the data described 
above, and publicly-available information, I have learned that: 
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a. On or about August 3, 2018, NATALIE MAYFLOWER 
SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a “Natalie May 
Edwards,” a/k/a “May Edwards,” the defendant, sent an email from 
the EDWARDS Personal Account to another web-based email account 
bearing the name of Reporter-1, stating in the Subject line: 
“Can you add,” followed by, in the text of the email, “The 
others if there are others to this file .. .” The email 
attached a document listing the titles and Internet links for 
the October 2017 Article, the November 2017 Article, and the 
January 2018 Article, among other things. 


b. Internet search history records relating to the 
EDWARDS Personal Account reflect, among other things, that: 


1 On or about October 30, 2017, approximately 
one day after the October 2017 Article was published, the user 
of the EDWARDS Personal Account ran an Internet search for 
“these 13 wire transfers are a focus of the fbi probe into 
paul,” and seconds later, visited the News Organization website 
to view the October 2017 Article. The title of the October 2017 
Article was “These 13 Wire Transfers Are A Focus of the FBI 
Probe Into Paul Manafort.” 


ii. On or about February 20, 2018, approximately 
one day after the February 2018 Article was published, the user 
of the EDWARDS Personal Account ran an Internet search for 
“manafort under scrutiny,” and seconds later, visited the News 
Organization website to view the February 2018 Article. The 
February 2018 Article was entitled “Manafort Under Scrutiny for 
$40 Million in ‘Suspicious Transactions.’” 


iii. On or about August 31, 2018, approximately 
two days after the publication of the Second August 2018 
Article, the user of the EDWARDS Personal Account ran an 
Internet search for “[Reporter-1] articles.” 
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WHEREFORE, deponent prays that an arrest warrant for 
NATALIE MAYFLOWER SOURS EDWARDS, a/k/a “Natalie Sours,” a/k/a 
“Natalie May Edwards,” a/k/a “May Edwards,” the defendant, be 
issued and that EDWARDS be arrested and imprisoned, or bailed, 
as the case may be. 








LY P. ECKSTUT 
Special Agent 
Federal Bureau of Investigation 


is hid eg 


Sworn to before me this 
16th day of October, 






HONORABLE GABRIEL W. GO NSTEIN |, 7 
NITED STATES MAGIST JUDGE, +: 7 


SOUTHERN DISTRICT OF NEW YORK 00") 00 6 8 
posecat b for Haas | 


18 


